Template Porter for Confluence privacy

Where the application runs

Template Porter is an Atlassian Forge application. Its interface and functions run on infrastructure operated by Atlassian, and it stores data only in Atlassian-hosted storage for your own installation. Atesen Software operates no server and no database for it.

What it talks to

Only your own Confluence site and Atlassian's Personal Data Reporting service. The application has no external egress permission, analytics, remote backend or third-party code.

What it stores

• A pending import or copy plan contains its decision list and the selected template bodies. It does not store the contents of your Confluence pages.
• A template body can contain an Atlassian account ID inside an ri:user mention. The application scans that temporary body in place and does not create a separate user profile or account-ID index.
• The plan records the earliest time the temporary personal data was retrieved so the correct age can be sent to Atlassian's Personal Data Reporting API.

How long it is kept

Every plan header and template body is written with a 24-hour Forge KVS TTL. The application also deletes template bodies when a run finishes and deletes a discarded plan immediately.

At 24 hours the application treats the plan as expired and will not return or apply it. Forge's physical TTL deletion is asynchronous and can take up to 48 additional hours. When the application is uninstalled, Atlassian deletes its stored data for your site.

Account privacy requests

Once a week, the application discovers account IDs directly inside the temporary template bodies and reports each one with its earliest retrieval time through Atlassian's Personal Data Reporting API. If Atlassian returns closed or updated for an account, the application deletes the whole pending plan containing it.

Data residency

The application uses Atlassian-hosted storage, which follows the residency of your Confluence site. It keeps its data only in Forge hosted storage (the Forge Key-Value Store) and has no remote backend, no external egress permission and no Atesen Software server, so it has no data location of its own to choose.

Atlassian documents that an app storing all of its in-scope End-User Data exclusively in persistent Forge hosted storage is eligible for the PINNED status shown to administrators, and that Forge moves that data when the administrator moves the Confluence site to another location. Atlassian also documents that Forge aims to run an invocation in the same location as the host product but may sometimes run it elsewhere.

Atlassian: Forge data residency

Data residency: what is in scope

In scope is everything the application writes to Forge hosted storage. It writes only the temporary record of one pending import or copy run:

• The plan header: a random plan ID, the kind of run (import or copy), its status, creation and retrieval times, the source site address and space key, the target space keys, the name-clash policy, the decision list (each template name, the name it would get, and the action create, skip, rename or overwrite, with any warnings) the names and reasons of templates left out of the run and, as the run proceeds, the per-template result.
• The selected templates, one record each: name, description, labels and body in Confluence storage format. A body can contain Atlassian account IDs inside person mentions.
• Every one of these records is written with a 24-hour Forge KVS TTL; template bodies are deleted when the run finishes and a discarded plan is deleted at once.

Data residency: what is out of scope

• Anything sent to Atesen Software: nothing is. The application makes no network call outside Atlassian and keeps no copy of your data on any server of ours.
• Your Confluence content itself, including the templates and spaces the application reads and writes. Confluence holds it under your site's own data residency settings.
• The exported template JSON file and the CSV report. They are created in the browser of the person running the export or report and are kept wherever that person saves them.
• Application logs. They contain event names and counts only: no template names, template content or user identifiers.
• Account IDs sent to Atlassian's Personal Data Reporting service once a week. That service is operated by Atlassian and is not part of the application's storage.